Will a provider refund charges from a stolen API key? Not as a right. OpenAI's, Anthropic's and Google Cloud's terms each make the customer responsible for all use of its account, including use through its API keys, and none of them promises a refund for usage on a stolen key. Each has a support route for unauthorized activity, and any adjustment is the provider's decision, case by case. Revoke the key, report it quickly with evidence, and treat provider spend limits and scoped keys as your real protection.
What the terms say
The language is close across the three providers: the account holder answers for what happens under the account, and must tell the provider when something goes wrong.
| Provider | Responsibility | Notification duty | Refunds |
|---|---|---|---|
| OpenAI (Services Agreement) | "Customer is responsible for all activities that occur under its Account" | "promptly notify OpenAI if it becomes aware of unauthorized access to the Account" | Fees "are non-refundable except as required by law or as otherwise specifically permitted"1 |
| Anthropic (Commercial Terms) | "Customer is responsible for all activity under its account" | "promptly notify Anthropic" if the account "has been compromised" | Customer "is responsible for fees incurred by its account"2 |
| Google Cloud (Terms of Service) | Responsible for "the security of its passwords for the Account (including any keys for Google APIs) and for any use of its Account" | "promptly notify Google of any unauthorized use" | No stolen-key provision; Gemini API postpay accounts follow the Google Cloud refund policy34 |
OpenAI's own help center states the consequence directly: an exposed key "can allow unauthorized API usage through your account, which can result in charges"5. OpenAI's agreement also forbids customers to "buy, sell, or transfer API keys" with a third party1, so a key you handed to an unvetted tool is not only a security question.
Read the notification duty as practical advice, not only an obligation. The sooner the provider knows, the sooner it can see the pattern, and the fewer hours of usage there are to argue about.
What support routes exist
OpenAI. Delete the key in the API key dashboard, review usage and keep the details, then contact OpenAI Support by opening a chat on any Help Center page, including the activity you did not perform or authorize5. For a compromised account or key there is also an Unauthorized Activity webform with the option "Report unauthorized activity involving my account"6.
Anthropic. Revoke the key in the Claude Console and create a new one; if you continue to see suspicious activity or have other concerns, contact the support team through the link in the help article7.
Google Cloud and the Gemini API. Google's billing documentation is the most explicit. For charges after a compromise: secure the account, including rotating API keys; stop or delete resources you do not recognise; then contact Cloud Customer Care to report the compromise and discuss possible billing adjustments, which "Google Cloud reviews … on an individual basis". It also warns that you may still see charges for usage just before and after a suspension8.
None of the three publishes criteria for when stolen-key usage is adjusted.
What reportedly happened in real cases
Reported outcomes vary, and none of them is a precedent.
- OpenCode Console, October 2026. BleepingComputer reported that OpenCode's email to affected users mentioned the possibility of reimbursement, without details, and that users reported unauthorized charges from several hundred dollars to over $1,7009. That is OpenCode's own message about its own incident; it says nothing about what OpenAI, Anthropic or Google will do. What OpenCode has said is covered separately.
- A Google Cloud account, June 2026. The Register reported a developer charged $11,089.77 over two days, mostly on Gemini image models, after what Google attributed to a compromised service account key. Google suspended the account for "abusive activity consistent with hijacked resources", and the developer said its billing team repeatedly refused to waive the charges, citing its shared responsibility model; Google did not respond to The Register's questions10.
Forums carry more stories in both directions. Treat them as anecdotes: the outcome depends on the provider, the evidence, how fast you acted, and decisions you cannot see.
A chargeback is not a shortcut
Disputing the card payment with your bank can feel like the faster route. Google documents what happens: the bank treats it as a chargeback; if Google disagrees and the bank does not side with you, the charge stands; if Google disagrees and the bank sides with you anyway, "Your account will have an overdue balance"8. In other words, the chargeback moves money, but it does not settle whether you owe the provider, and an overdue balance on the account that runs your production AI is its own incident. The Register also reported that Google may hold developers liable even after a card issuer reversed charges as fraud10. Go to the provider first.
How to make a request that can be assessed
If you ask for an adjustment, give support what it needs to separate your traffic from the attacker's:
- The key: its name or ID, project or workspace, and who owned it.
- The timeline in UTC: when the key leaked (if known), when you noticed, when you revoked it.
- The usage you dispute: a per-key usage export for the window, with the models, volumes and hours that are not yours.
- Your normal pattern: the same key's usage for a normal week, so the difference is visible.
- How it leaked, as far as you know: a public repository, a third-party tool, a log file.
- What you have changed: the replacement key, limits and restrictions now in place.
Do not overstate. If you cannot show where the key leaked from, say so.
Why prevention is the only reliable protection
Every route above depends on someone else's discretion. The controls that do not are the ones you set before the leak, and the ones that matter most are at the provider, because a stolen provider key is used directly against the provider:
| Control | OpenAI | Anthropic | Google (Gemini API) |
|---|---|---|---|
| Hard spend limit | Organization and project hard limits; 429 when reached; "Enforcement is not instantaneous"11 | Organization limit on the Billing page and workspace limits; 400 when a limit you set is reached12 | Project spend caps, experimental; billing data can lag around 10 minutes and overages are possible4 |
| Alerts | Spend alerts, which "do not enforce a cap"11 | Workspace notifications | Cloud Billing budgets |
| Narrow keys | Project keys, restricted permissions, IP allowlist | Workspace-scoped keys with expiry | API and application restrictions |
Add the habits that make a stolen key worth less: one key per workload so you can revoke it without an outage, expirations, no keys in client code or shared tools, and usage watched per key. LLM spend limits compared goes through each limit's scope and lag in detail, and the runbooks for a leaked OpenAI key and a leaked Anthropic key cover the first hour.
How INFRO handles spend on stolen keys
INFRO runs on provider accounts you connect and charges a software subscription; it is not part of the money flow between you and your provider, so it cannot refund or absorb provider charges. What it can do is limit traffic that goes through it: budgets per organization, project, member and gateway key are checked before the provider is called and refuse with 402 once spent, gateway keys can be limited to IP ranges, providers and one environment, and spend alerts flag a day that departs from a scope's usual day.
Those controls govern traffic that goes through INFRO. A provider key stolen from anywhere, including from a platform like INFRO that holds customers' provider keys, can be used directly against the provider, and no INFRO budget sees that spend. The provider-side limits in the table above are the backstop. On the Business plan, with usage access on, reconciliation compares OpenAI's and Anthropic's own usage per key with the traffic that passed through INFRO, which can show spend on your keys that bypassed the gateway.
Summary
Under the standard terms of OpenAI, Anthropic and Google Cloud, usage on your account is your responsibility, stolen key or not, and you are expected to report unauthorized access promptly. Refunds are discretionary and case by case. Report fast, with a per-key timeline and evidence, go to the provider before your bank, and put hard limits and narrow keys in place so that the next stolen key has a ceiling you chose. This is not legal advice.